CVE-2026-108758
High
Description
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.
SeverityHigh
CVSS8.2
Exploit probability—
ProductAlextselegidis Easyappointments
PublishedOct 11, 2026
First seenOct 11, 2026
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alextselegidis easyappointments | v ≤ 1.6.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.